📰 Dev.to · BeyondMachines

phpBB version 3.3.17 patches a critical authentication bypass (CVE-2026-48611) that allows unauthenticated attackers to take over any account, including adminis

Google released Chrome 150, fixing 433 security vulnerabilities including 20 critical use-after-free and memory corruption flaws. The update fixes issues in com

Citrix fixed six vulnerabilities in NetScaler ADC and Gateway, including high-severity memory overflows and the "HTTP/2 Bomb" denial-of-service flaw. These bugs

Apple released security updates for iOS, macOS, and Safari to fix 37 vulnerabilities, including 26 WebKit flaws.

Cato AI Labs identified two critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE that allow attackers to achieve remote code execution via

Aflac Japan reported a data breach affecting 4.38 million policyholders after unauthorized actors accessed the 'Aflac Yoriso Net' portal for ten days. The breac

curl version 8.21.0 addresses 18 vulnerabilities, including a 25-year-old authentication bypass (CVE-2026-8932) and multiple memory safety issues. The flaws pri

Xsolis, a healthcare technology firm, suffered a data breach affecting nearly 1.4 million people after a targeted phishing attack allowed unauthorized access to

Atlassian's June 2026 security update addresses 100 vulnerabilities, including critical flaws in third-party dependencies like Axios, Apache Tomcat, and Netty.

LiteLLM patched a critical vulnerability chain (CVSS 9.9) that allows low-privilege users to escalate privileges and execute arbitrary code on AI gateway server

Oracle issued an emergency patch for a critical code injection vulnerability (CVE-2026-35273, CVSS 9.8) in PeopleSoft Enterprise PeopleTools that allows unauthe

A high-severity use-after-free vulnerability in the Linux kernel's nf_tables subsystem (CVE-2026-23111) allows unprivileged local users to escalate privileges t

Arm reports a critical privilege escalation vulnerability (CVE-2025-10263) affecting multiple CPU cores, including Neoverse and Cortex models, due to a timing f

Palo Alto Networks patched a high-severity authentication bypass vulnerability (CVE-2026-0257) in PAN-OS and Prisma Access that is being exploited to gain unaut

Kennedy McLaughlin & Associates, an Australian accounting firm, confirmed a data breach after the Qilin ransomware group published stolen client financial recor

Gogs is reported to have a critical unpatched authenticated RCE vulnerability (CVSS 9.4) that allows users to execute arbitrary code via malicious branch names

Carnival Corporation reported a data breach resulting from a social engineering attack on an employee account that exposed names, addresses, and government iden

7-Zip version 26.00 and earlier contain a critical heap buffer overflow (CVE-2026-48095) in the NTFS handler that allows attackers to execute arbitrary code via

During the week of May 18–25, 2026, there were 18 advisories and 23 incidents impacting over 2 million individuals. Healthcare is the hardest-hit industry and t

A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) is being exploited to steal administrative keys and inject malicious 'ClickFix' scripts int

Charter Communications is investigating a data breach claimed by the ShinyHunters group, who allege they stole 42 million customer records via compromised cloud

LiteSpeed Technologies patched a critical, actively exploited vulnerability (CVE-2026-48172, CVSS 10.0) in its cPanel plugin that allows any user to run scripts

NGINX has disclosed a critical heap buffer overflow vulnerability (CVE-2026-9256) in its rewrite module that allows unauthenticated attackers to cause denial-of

Between May 11–18, 2026, there were 18 vulnerability advisories and 16 cybersecurity incidents affecting roughly 839,000 individuals. Ransomware/malware driving